Last updated: 6 October 2026
Lost In Madeira, hereinafter referred to as “Lost In Madeira”, takes the protection of its customers’ personal data seriously. This Privacy Policy explains how we collect, use and protect your personal data when you make a booking or contact Lost In Madeira.
- Data controller
The data controller for personal data is:
Name: Vitor Miguel Rocha Serrão
Trade name: Lost In Madeira
Tax ID (NIF): 218756712
Address: Rua Levada de Santa Luzia, n.º 112, casa 6, 9050-434 Funchal, Portugal
Email: vitor@lostinmadeira.pt
Phone/WhatsApp: +351 968 706 609 - Personal data collected
We may collect the following personal data:
Identification data: name, email, phone number and address;
Booking data: hike date, number of participants and preferences;
Payment data: information needed to process payment, where applicable;
Health data and special conditions: medical conditions, allergies, mobility limitations or other information relevant to the safety of the activity, where voluntarily provided by the customer;
Other data: any information you voluntarily send us through contact forms, email or WhatsApp.
We do not request health data that is not necessary to assess the safety of participation. Where it is provided, it will be processed only for that purpose and on the appropriate legal basis. - Purposes of processing
We process your personal data in order to:
Manage, confirm and organise bookings;
Provide the guided hiking services you have booked;
Send confirmations, instructions and necessary information about the activity;
Ensure participants’ safety;
Comply with legal, tax, accounting and insurance-related obligations;
Respond to requests, questions or complaints;
Improve our services and customer support;
Send newsletters or marketing communications, only where valid consent exists. - Legal basis
The processing of personal data is based, as applicable, on:
Performance of a contract: to manage the booking and provide the service you have booked;
Compliance with legal obligations: for example, tax, accounting or insurance-related obligations;
Legitimate interest: to ensure safety, improve our services, prevent abuse and defend our rights;
Consent: for example, for marketing communications or for the voluntary processing of certain health information, where required by law. - Data sharing
Personal data may be shared, where necessary, with:
Payment platforms;
Booking management systems;
Email services, website hosting and data storage providers;
Insurers, where necessary for insurance or accident purposes;
Accountants, consultants or service providers acting on our behalf;
Public authorities, where required by law.
These providers must process data only in accordance with our instructions and applicable law. We do not sell your personal data. - International transfers
Some service providers may process data outside the European Economic Area. Where this happens, we will seek to ensure that the transfer is carried out in accordance with the GDPR, in particular through a European Commission adequacy decision or standard contractual clauses approved by the European Commission.
If we use specific providers involving international transfers, the relevant information will be updated in this Policy. - Retention period
We keep personal data only for as long as necessary for the purposes for which it was collected.
Booking data is kept for the period needed to organise the activity and handle any subsequent matters;
Data that must be kept to comply with tax, accounting, insurance or other legal obligations is kept for the period required by law;
Data used for marketing is kept until the customer withdraws consent or there is no longer a legal basis for processing;
Health data or special conditions are deleted as soon as they are no longer needed to ensure the safety of the activity, unless another legal obligation requires them to be kept. - Customer rights
Under the GDPR, customers may, where applicable:
Request access to their personal data;
Request rectification of inaccurate or incomplete data;
Request erasure of their data;
Request restriction of processing;
Object to certain processing;
Request data portability;
Withdraw consent, where processing is based on consent;
Not be subject to a decision based solely on automated processing, where applicable.
The exercise of these rights may be subject to the limitations provided by law, in particular where keeping the data is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
To exercise your rights, contact us by email or WhatsApp. We will reply within the applicable legal deadline.
Customers also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), via its website: www.cnpd.pt. - Data security
The website may use cookies and similar technologies to ensure it works properly, improve the user experience, analyse traffic and, where applicable, carry out marketing activities. - Cookies
We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or improper disclosure. Access to data is limited to the persons and entities that need it for the stated purposes.
Non-essential cookies should only be used in accordance with the options chosen by the user in the cookie banner. For more information, see the Cookie Policy. - 11. Photos and videos
Identifiable photos or videos of participants will be used for promotion or marketing only with valid authorisation, where required. Customers may refuse such use without this affecting their participation in the hike. - Changes to this Policy
We may update this Privacy Policy to reflect legal or regulatory changes or changes in our practices. The version in force is the one published on the website on the date you consult it. - Contact
For questions relating to privacy or data protection:
Email: vitor@lostinmadeira.pt
Phone/WhatsApp: +351 968 706 609
Address: Rua Levada de Santa Luzia, n.º 112, casa 6, 9050-434 Funchal, Portugal